Observing packet spoofing by ISPs (8)

Performing these tests from behind NAT could produce valid results but creates some uncertainty about whether unexpected network behaviour is due to an ISP or a local NAT router.

A public IP address is one that another party can use directly to communicate with you without the need to configure a tunnel or firewall rule or use a proxy to connect. 6

If you are using an institutional network connection, such as at a school or business, that has a firewall that you are not permitted to disable, you may still be able to perform these tests, but any packet spoofing you detect may be a result of your institution’s firewall rather than its upstream ISP connection.

As we describe below, observing packet-spoofing shows that someone is doing it, but does not directly reveal who. We want to reduce the number of possible responsible parties.

Therefore, before beginning the test, disable any firewalls and NATs located between your computer and the Internet - including both software or “personal” firewalls running on your computer and firewall appliances or firewall functionality in routers.

As an alternative, connect your computer to a point on the network located outside of any firewalls or NAT routers (for example, by directly connecting it to a cable modem or Digital Subscriber Line (DSL) modem). Some network designs and documentation refer to this location as a DMZ.

Step 3. If possible, disable TCP and UDP checksum offloading and TCP segmentation offloading.

Checksum offloading (sometimes called “TCP checksum offloading”, although UDP checksums may also be offloaded) is a feature of some recent Ethernet cards, particularly Gigabit Ethernet-capable cards, that allows the Ethernet card to construct portions of some network packets in hardware, saving load on the CPU.

courtesy: EFF

ITREALMS Online ... delivering news for ICT4D